Measuring Quox Against the OWASP Agentic Top 10

The scorecard an agent platform should want

In December 2025, OWASP published a Top 10 for autonomous agents: the ten ways an agent that uses tools, spends money, delegates work and acts on real systems goes wrong. Goal hijack. Tool misuse. Identity and privilege abuse. Memory poisoning. Rogue agents that ignore a stop.

For a platform whose whole job is running agents against production systems, it is exactly the right scorecard, so we are holding Quox to it in the open.

One distinction runs through this series: a control that is designed is not the same as a control proven it cannot be bypassed. We are treating the list as a living, evidence-backed register, and publishing the proofs as they land, including the categories where they show us work still to do.

Intelligence is not authority

The reason an agent platform can be held to a standard like this at all is architectural. Quox keeps the model's intelligence and the authority to act in two different places.

The agent proposes. Policy constrains what is allowed. A human approves anything that carries risk. The runtime, not the model, decides whether an action runs or is refused. Whatever happens is written to a tamper-evident record.

Authority lives outside the language model, which means a confused, jailbroken or outright hostile agent is arguing with a gate it does not control. That separation is what the OWASP risks are really testing, and it is the thing we built first.

We did not build this because OWASP published a list. The list arrived and found the architecture already in place: authority outside the model, evidence under everything. Being ready for it is the part we are proud of. Proving it against each risk, in public and with receipts, is the part we are doing now.

What is already built

Four of these controls are in the product today. We describe them here as built and tested, not as a finished proof: the live adversarial verification is the next set of posts.

• Credential custody. An agent working through Quox does not hold the keys it uses. Secrets live in the vault; when a tool call needs one, the platform resolves it server-side and makes the call, and the model sees the result, never the secret.
• Approvals bound to the real action. When a step needs a human, the approval card is built server-side from the exact tool and arguments, so a person signs off on what will actually run, not on an agent's summary of it. The grant is tied to those arguments and is single-use, so changing them afterwards cannot reuse it. Sensitive approvals require a step-up PIN.
• Credentials that can be leased, not handed over. A secret can be released just-in-time for a single use, and a revoked lease takes effect immediately.
• A record you can check yourself. Every governed action lands on a tamper-evident, hash-chained record as it happens, and the evidence is yours to recompute. A refusal is recorded exactly like a success.

The part most security copy skips

Here is the uncomfortable half, because an evidence platform that hid it would have failed its own first test.

Everything above is a control that exists in the code. Proving each one holds under a real attack, that the gate actually refuses the thing it should refuse, is separate work, and it is the work these posts will show. We are running adversarial fixtures against each OWASP category inside a governed security engagement: the attempted action, the enforcement decision, and the evidence, each independently verifiable.

We are not claiming OWASP certification, and we are not claiming a clean ten out of ten. We will earn each one in public, or we will say plainly what is not earned yet.

What comes next

From here the series takes the OWASP risks one at a time. Each post will show an agent attempting something it should not be allowed to do, the decision the runtime actually made, and the record you can verify for yourself. When the set is complete, we will put it in one place.

Until then, every claim on this page is something you can already read in the product and its security documentation, and nothing here is a result we have not earned.